WordPress Pods plugin: unauthenticated privilege escalation via AJAX auth bypass
Pods WordPress plugin (≤3.3.9): an AJAX authorization bypass silently swallows auth failures via pods_error(), allowing unauthenticated privilege escalation on affected sites.
- Vendor
- Pods Framework
- Product
- Pods – Custom Content Types and Fields WordPress Plugin (all versions through 3.3.9)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The Pods plugin routes admin AJAX actions through the pods_admin AJAX router, which funnels every access check — login enforcement, capability gates, nonce verification — through pods_error(). Under the JSON meta-box-loader compatibility path, pods_error() writes failures to the PHP error log and returns false rather than halting execution. Downstream access checks complete regardless. An unauthenticated attacker can trigger privileged operations through this path without valid credentials.
Affected versions: All Pods releases through 3.3.9.
Patch: Update Pods to the latest available version via the WordPress plugin directory. Sites running Pods as core infrastructure for custom post types should prioritize this — the AJAX surface this flaw exposes is likely active in any non-trivial Pods deployment.
NVD record: CVE-2026-19598
